APP fraud: what banks and fintechs need to catch earlier

TL;DR: APP fraud relies on social engineering, real-time payment speed and, increasingly, AI-generated impersonation to persuade authorised users to send money to scammers, according to Alloy. The control problem is not credential theft but trust verification at the point of payment, where behavioural signals and step-up checks must interrupt manipulation before funds move.

Editorial analysis by NHI Mgmt Group, based on content published by Alloy: “How to recognize and prevent authorized push payment (APP) fraud”.

By the numbers:

• 85% of Americans worry that scams are becoming harder to spot because of AI.
• 67% of consumers surveyed in Alloy’s 2025 State of Scams Report believe their financial institutions should reimburse them for money lost in a scam.
• Deloitte projects APP losses alone could amount to $14.9B by 2028.

Key questions

Q: What breaks when APP fraud is treated like a normal account takeover case?

A: The control model breaks because APP fraud does not depend on stolen credentials or unauthorised access.

Q: Why do real-time payments increase APP fraud risk?

A: Real-time payments compress the window between authorisation and settlement, which gives defenders less time to detect manipulation or reverse the transfer.

Q: What are the signs that APP fraud detection is too late?

A: Late detection usually shows up when analysts only see risk after the payment request is submitted or after the funds have already moved.

Practitioner guidance

• Deploy behavioural risk scoring at payment time Use device signals, recipient novelty, transfer size, timing and login context to raise risk when a transaction deviates from the customer’s normal pattern.
• Add step-up verification for high-risk transfers Trigger additional checks when the customer changes device, adds a new recipient or attempts an unusually large transfer to a first-time payee.
• Build friction into instant-payment flows Insert review holds or warning prompts for suspicious transactions so customers have time to recognise manipulation before money leaves the account.

Bottom line: APP fraud succeeds because attackers manipulate authorised users into sending money themselves, which makes the transaction look legitimate until it is too late to stop.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →